CVE-2026-19586

CVE-2026-19586 is a pre-authentication OS command injection flaw (CWE-78) in TP-Link Omada business gateways when they are configured to operate as an OpenVPN Server, caused by insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker who can reach the VPN service can send specially crafted input during a connection attempt to influence backend command execution before authentication completes, gaining arbitrary command execution and potentially full compromise of the gateway, which typically sits at the network edge controlling routing and VPN for the whole site. Affected organizations are those running any of the listed Omada gateway models with the OpenVPN Server feature enabled and reachable by the attacker. TP-Link rates the issue critical (CVSS 4.0 base score 9.3). A public technical write-up/PoC exists and EPSS assigns a 5.7% probability of exploitation within 30 days (93rd percentile), but exploitation has not yet been confirmed in the wild and the flaw is not in CISA KEV.

What to do: Update all listed Omada gateway models to the latest firmware per TP-Link's security advisory (fixed version numbers are not specified in the available data, so check the advisory for affected/fixed ranges). Until patched, disable OpenVPN Server or restrict access to the VPN service (e.g., firewall/ACL rules limiting UDP 1194 to trusted sources). Inventory your estate for these gateway models, confirm whether OpenVPN Server is enabled and reachable, and review VPN logs for anomalous connection attempts.